diff --git a/.gitbot-fleet/report-backs/README.md b/.gitbot-fleet/report-backs/README.md index 303a9e06..a8ccf4cc 100644 --- a/.gitbot-fleet/report-backs/README.md +++ b/.gitbot-fleet/report-backs/README.md @@ -33,8 +33,8 @@ scanner words (`critical`, `high`, `medium`, `low`); both normalise. **How the files get here.** The `fleet` job of `.github/workflows/hypatia-scan.yml` (gitbot-fleet's `fleet-report-back-reusable.yml`) runs the enrolled adapters on the PR head and uploads the envelopes as the `fleet-report-backs` artifact; -the fork-local Hypatia reusable downloads that artifact into this directory -just before it renders the grid (fork delta 4). Nothing is ever committed here: +the standards `hypatia-scan-reusable.yml` downloads that artifact into this +directory just before it renders the grid. Nothing is ever committed here: an envelope is evidence about one commit, and a committed one would read as current when it is stale. The directory exists because this repository's deed declares it (`MetaManifold-WebUI_chora.deed`, diff --git a/docs/maintenance/repository-hygiene.md b/docs/maintenance/repository-hygiene.md index 0a47c72c..44b8f0e5 100644 --- a/docs/maintenance/repository-hygiene.md +++ b/docs/maintenance/repository-hygiene.md @@ -378,8 +378,9 @@ recorded here so the choice does not have to be rediscovered. 6. **Reconciling the `hyperpolymath/standards` pins.** Seven workflows reference that repository at four different commits, two of them inside `hypatia-scan-reusable.yml` itself (that file was deleted on 2026-11-10; the - governance lanes now share one pin). Some pins are deliberate and pinned by - `scripts/check-governance-contract.sh` (`c6d78606…` for K9, the secret - scanner and Scorecard; `01c9b0c9…` for the verdict-grid renderer), so a + governance lanes now share one pin). Some pins are deliberate and checked by + `scripts/check-governance-contract.sh` (`c6d78606…` for the secret scanner + and Scorecard copies; one shared pin, `d73229d8…` on 2026-11-10, for the + DEED, K9 and Hypatia lanes and the posting engine), so a reconciliation has to move the contract's constants and the allowlist digest together, and is a review of its own rather than a tidy.